GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47259 (GCVE-0-2021-47259)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:19 – Updated: 2026-08-05 08:47
VLAI
Title
NFS: Fix use-after-free in nfs4_init_client()
Summary
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix use-after-free in nfs4_init_client() KASAN reports a use-after-free when attempting to mount two different exports through two different NICs that belong to the same server. Olga was able to hit this with kernels starting somewhere between 5.7 and 5.10, but I traced the patch that introduced the clear_bit() call to 4.13. So something must have changed in the refcounting of the clp pointer to make this call to nfs_put_client() the very last one.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-22 16:41 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da , < c7eab9e2d7b4e983ce280276fb920af649955897 (git)
Affected: 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da , < 42c10b0db064e45f5c5ae7019bbf2168ffab766c (git)
Affected: 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da , < 3e3c7ebbfac152d08be75c92802a64a1f6471a15 (git)
Affected: 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da , < c3b6cf64dfe4ef96e7341508d50d6998da7062c7 (git)
Affected: 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da , < 72651c6579a25317a90536181d311c663d0329ab (git)
Affected: 8dcbec6d20eb881ba368d0aebc3a8a678aebb1da , < 476bdb04c501fc64bf3b8464ffddefc8dbe01577 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 4.14.237 , ≤ 4.14.* (semver)
Unaffected: 4.19.195 , ≤ 4.19.* (semver)
Unaffected: 5.4.126 , ≤ 5.4.* (semver)
Unaffected: 5.10.44 , ≤ 5.10.* (semver)
Unaffected: 5.12.11 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
linux linux_kernel Affected: 4.13
    cpe:2.3:o:linux:linux_kernel:4.13:*:*:*:*:*:*:*
Create a notification for this product.
linux linux_kernel Affected: 8dcbec6d20eb , < 476bdb04c501 (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:4.13:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "4.13"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "476bdb04c501",
                "status": "affected",
                "version": "8dcbec6d20eb",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47259",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-22T16:41:04.603993Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:09.514Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.994Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c7eab9e2d7b4e983ce280276fb920af649955897"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/42c10b0db064e45f5c5ae7019bbf2168ffab766c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3e3c7ebbfac152d08be75c92802a64a1f6471a15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c3b6cf64dfe4ef96e7341508d50d6998da7062c7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/72651c6579a25317a90536181d311c663d0329ab"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/476bdb04c501fc64bf3b8464ffddefc8dbe01577"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c7eab9e2d7b4e983ce280276fb920af649955897",
              "status": "affected",
              "version": "8dcbec6d20eb881ba368d0aebc3a8a678aebb1da",
              "versionType": "git"
            },
            {
              "lessThan": "42c10b0db064e45f5c5ae7019bbf2168ffab766c",
              "status": "affected",
              "version": "8dcbec6d20eb881ba368d0aebc3a8a678aebb1da",
              "versionType": "git"
            },
            {
              "lessThan": "3e3c7ebbfac152d08be75c92802a64a1f6471a15",
              "status": "affected",
              "version": "8dcbec6d20eb881ba368d0aebc3a8a678aebb1da",
              "versionType": "git"
            },
            {
              "lessThan": "c3b6cf64dfe4ef96e7341508d50d6998da7062c7",
              "status": "affected",
              "version": "8dcbec6d20eb881ba368d0aebc3a8a678aebb1da",
              "versionType": "git"
            },
            {
              "lessThan": "72651c6579a25317a90536181d311c663d0329ab",
              "status": "affected",
              "version": "8dcbec6d20eb881ba368d0aebc3a8a678aebb1da",
              "versionType": "git"
            },
            {
              "lessThan": "476bdb04c501fc64bf3b8464ffddefc8dbe01577",
              "status": "affected",
              "version": "8dcbec6d20eb881ba368d0aebc3a8a678aebb1da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.126",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.237",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.195",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.126",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.44",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.11",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix use-after-free in nfs4_init_client()\n\nKASAN reports a use-after-free when attempting to mount two different\nexports through two different NICs that belong to the same server.\n\nOlga was able to hit this with kernels starting somewhere between 5.7\nand 5.10, but I traced the patch that introduced the clear_bit() call to\n4.13. So something must have changed in the refcounting of the clp\npointer to make this call to nfs_put_client() the very last one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - This is NFS client code in fs/nfs/nfs4client.c (nfs4_init_client), reached via local mount or NFSv4 referral/submount automount (nfs_d_automount \u2192 nfs4_create_referral_server \u2192 nfs4_set_client \u2192 nfs_get_client), not via nfsd/ksmbd or unsolicited packet processing.\nAC:L - An attacker who can mount two exports via different NICs of the same server, or drive referral/migration to a trunking-matched address (including a cooperating/malicious NFS server), fully controls the trunking-discovery path that yields clp != old and frees clp before clear_bit; no race or layout outside attacker influence is required.\nPR:L - Although a fresh NFS mount needs CAP_SYS_ADMIN (nfs_fs_type lacks FS_USERNS_MOUNT), an unprivileged user can reach nfs4_init_client via NFSv4 referral/submount automounts or migration on an already-mounted export, matching prior CNA scoring of this same init path.\nUI:N - Once an NFS share is present, the attacker triggers the bug themselves by mounting/walking a referral or exercising migration; no separate victim action is required beyond that environmental mount.\nS:U - The use-after-free corrupts host kernel heap state within the same OS security authority and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - nfs_put_client can kfree the nfs_client while clear_bit still writes clp-\u003ecl_flags, a classic slab UAF; reclaim of the freed object enables arbitrary kernel memory disclosure under standard UAF exploitation.\nI:H - The post-free clear_bit is a write into freed nfs_client memory, and heap spraying the reclaimed object yields arbitrary-write and control-flow hijacking primitives consistent with scoring other kernel UAFs as High integrity.\nA:H - Use-after-free of struct nfs_client causes kernel oops/panic when the freed object is touched (KASAN reported this path), so availability impact is High even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:00.677Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c7eab9e2d7b4e983ce280276fb920af649955897"
        },
        {
          "url": "https://git.kernel.org/stable/c/42c10b0db064e45f5c5ae7019bbf2168ffab766c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e3c7ebbfac152d08be75c92802a64a1f6471a15"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3b6cf64dfe4ef96e7341508d50d6998da7062c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/72651c6579a25317a90536181d311c663d0329ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/476bdb04c501fc64bf3b8464ffddefc8dbe01577"
        }
      ],
      "title": "NFS: Fix use-after-free in nfs4_init_client()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47259",
    "datePublished": "2024-05-21T14:19:52.738Z",
    "dateReserved": "2024-05-21T13:27:52.125Z",
    "dateUpdated": "2026-08-05T08:47:00.677Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47259",
      "date": "2026-09-17",
      "epss": "0.00707",
      "percentile": "0.51809"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47259\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:14.610\",\"lastModified\":\"2026-08-04T10:16:55.460\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFS: Fix use-after-free in nfs4_init_client()\\n\\nKASAN reports a use-after-free when attempting to mount two different\\nexports through two different NICs that belong to the same server.\\n\\nOlga was able to hit this with kernels starting somewhere between 5.7\\nand 5.10, but I traced the patch that introduced the clear_bit() call to\\n4.13. So something must have changed in the refcounting of the clp\\npointer to make this call to nfs_put_client() the very last one.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: core: corrige el manejo de errores de scsi_host_alloc(). Despu\u00e9s de que el dispositivo se inicializa mediante device_initialize(), o su nombre se establece mediante dev_set_name(), el dispositivo debe liberarse mediante put_device (). De lo contrario, se filtrar\u00e1 el nombre del dispositivo porque se asigna din\u00e1micamente en dev_set_name(). Solucione la fuga reemplazando kfree() con put_device(). Dado que scsi_host_dev_release() maneja adecuadamente la eliminaci\u00f3n de IDA y kthread, elimine tambi\u00e9n estas may\u00fasculas y min\u00fasculas especiales del manejo de errores.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfs/nfs4client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\",\"lessThan\":\"c7eab9e2d7b4e983ce280276fb920af649955897\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\",\"lessThan\":\"42c10b0db064e45f5c5ae7019bbf2168ffab766c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\",\"lessThan\":\"3e3c7ebbfac152d08be75c92802a64a1f6471a15\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\",\"lessThan\":\"c3b6cf64dfe4ef96e7341508d50d6998da7062c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\",\"lessThan\":\"72651c6579a25317a90536181d311c663d0329ab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\",\"lessThan\":\"476bdb04c501fc64bf3b8464ffddefc8dbe01577\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfs/nfs4client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.237\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.195\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.126\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.44\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.11\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:4.13:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"4.13\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"8dcbec6d20eb\",\"lessThan\":\"476bdb04c501\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-22T16:41:04.603993Z\",\"id\":\"CVE-2021-47259\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.13\",\"versionEndExcluding\":\"4.14.237\",\"matchCriteriaId\":\"50FA0DA7-1172-4CFE-A09D-F2AEB8B0FB71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.195\",\"matchCriteriaId\":\"23EECCE9-4D4C-4684-AB00-10C938F5DDC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.126\",\"matchCriteriaId\":\"876275F9-BEC7-40E8-9D7F-A20729A4A4FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.44\",\"matchCriteriaId\":\"DA547B08-9D25-467B-AD0D-8460FE4EE70D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.11\",\"matchCriteriaId\":\"F914A757-FAFD-407E-9031-21F66635D5EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"96AC23B2-D46A-49D9-8203-8E1BEDCA8532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA610E30-717C-4700-9F77-A3C9244F3BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1ECD33F5-85BE-430B-8F86-8D7BD560311D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF351855-2437-4CF5-AD7C-BDFA51F27683\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3e3c7ebbfac152d08be75c92802a64a1f6471a15\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/42c10b0db064e45f5c5ae7019bbf2168ffab766c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/476bdb04c501fc64bf3b8464ffddefc8dbe01577\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72651c6579a25317a90536181d311c663d0329ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3b6cf64dfe4ef96e7341508d50d6998da7062c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c7eab9e2d7b4e983ce280276fb920af649955897\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e3c7ebbfac152d08be75c92802a64a1f6471a15\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/42c10b0db064e45f5c5ae7019bbf2168ffab766c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/476bdb04c501fc64bf3b8464ffddefc8dbe01577\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72651c6579a25317a90536181d311c663d0329ab\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3b6cf64dfe4ef96e7341508d50d6998da7062c7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c7eab9e2d7b4e983ce280276fb920af649955897\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:03:26+00:00",
      "cve": "CVE-2021-47259",
      "id": "CVE-2021-47259",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFS: Fix use-after-free in nfs4_init_client()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47259.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c7eab9e2d7b4e983ce280276fb920af649955897\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/42c10b0db064e45f5c5ae7019bbf2168ffab766c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3e3c7ebbfac152d08be75c92802a64a1f6471a15\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c3b6cf64dfe4ef96e7341508d50d6998da7062c7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/72651c6579a25317a90536181d311c663d0329ab\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/476bdb04c501fc64bf3b8464ffddefc8dbe01577\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:07.994Z\"}}, {\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47259\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-22T16:41:04.603993Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:4.13:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.13\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"8dcbec6d20eb\", \"lessThan\": \"476bdb04c501\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-22T16:40:57.469Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"NFS: Fix use-after-free in nfs4_init_client()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - This is NFS client code in fs/nfs/nfs4client.c (nfs4_init_client), reached via local mount or NFSv4 referral/submount automount (nfs_d_automount \\u2192 nfs4_create_referral_server \\u2192 nfs4_set_client \\u2192 nfs_get_client), not via nfsd/ksmbd or unsolicited packet processing.\\nAC:L - An attacker who can mount two exports via different NICs of the same server, or drive referral/migration to a trunking-matched address (including a cooperating/malicious NFS server), fully controls the trunking-discovery path that yields clp != old and frees clp before clear_bit; no race or layout outside attacker influence is required.\\nPR:L - Although a fresh NFS mount needs CAP_SYS_ADMIN (nfs_fs_type lacks FS_USERNS_MOUNT), an unprivileged user can reach nfs4_init_client via NFSv4 referral/submount automounts or migration on an already-mounted export, matching prior CNA scoring of this same init path.\\nUI:N - Once an NFS share is present, the attacker triggers the bug themselves by mounting/walking a referral or exercising migration; no separate victim action is required beyond that environmental mount.\\nS:U - The use-after-free corrupts host kernel heap state within the same OS security authority and does not cross a VM, IOMMU, or other security-authority boundary.\\nC:H - nfs_put_client can kfree the nfs_client while clear_bit still writes clp-\u003ecl_flags, a classic slab UAF; reclaim of the freed object enables arbitrary kernel memory disclosure under standard UAF exploitation.\\nI:H - The post-free clear_bit is a write into freed nfs_client memory, and heap spraying the reclaimed object yields arbitrary-write and control-flow hijacking primitives consistent with scoring other kernel UAFs as High integrity.\\nA:H - Use-after-free of struct nfs_client causes kernel oops/panic when the freed object is touched (KASAN reported this path), so availability impact is High even without a full exploit.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\", \"lessThan\": \"c7eab9e2d7b4e983ce280276fb920af649955897\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\", \"lessThan\": \"42c10b0db064e45f5c5ae7019bbf2168ffab766c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\", \"lessThan\": \"3e3c7ebbfac152d08be75c92802a64a1f6471a15\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\", \"lessThan\": \"c3b6cf64dfe4ef96e7341508d50d6998da7062c7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\", \"lessThan\": \"72651c6579a25317a90536181d311c663d0329ab\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8dcbec6d20eb881ba368d0aebc3a8a678aebb1da\", \"lessThan\": \"476bdb04c501fc64bf3b8464ffddefc8dbe01577\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfs/nfs4client.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.237\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.195\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.126\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.44\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfs/nfs4client.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c7eab9e2d7b4e983ce280276fb920af649955897\"}, {\"url\": \"https://git.kernel.org/stable/c/42c10b0db064e45f5c5ae7019bbf2168ffab766c\"}, {\"url\": \"https://git.kernel.org/stable/c/3e3c7ebbfac152d08be75c92802a64a1f6471a15\"}, {\"url\": \"https://git.kernel.org/stable/c/c3b6cf64dfe4ef96e7341508d50d6998da7062c7\"}, {\"url\": \"https://git.kernel.org/stable/c/72651c6579a25317a90536181d311c663d0329ab\"}, {\"url\": \"https://git.kernel.org/stable/c/476bdb04c501fc64bf3b8464ffddefc8dbe01577\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFS: Fix use-after-free in nfs4_init_client()\\n\\nKASAN reports a use-after-free when attempting to mount two different\\nexports through two different NICs that belong to the same server.\\n\\nOlga was able to hit this with kernels starting somewhere between 5.7\\nand 5.10, but I traced the patch that introduced the clear_bit() call to\\n4.13. So something must have changed in the refcounting of the clp\\npointer to make this call to nfs_put_client() the very last one.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.237\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.195\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.126\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.44\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.11\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13\", \"versionStartIncluding\": \"4.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:47:00.677Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47259\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:47:00.677Z\", \"dateReserved\": \"2024-05-21T13:27:52.125Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:19:52.738Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.